npm: trusted publishing with OIDC is generally available

2025-07-31 · Publisher : GitHub (npm) · Domain : Cloud & DevOps

On 31 July 2025, GitHub makes npm trusted publishing with OIDC generally available: a GitHub Actions or GitLab CI workflow publishes a package without a long-lived npm token, with provenance attestation by default.

### Background On 31 July 2025, GitHub announces that trusted publishing with OpenID Connect is generally available on the npm registry. It lets a package be published directly from a continuous integration workflow without storing an npm token: the registry trusts a specific workflow identity declared on npmjs.com. ### Key facts - Requirement: npm CLI 11.5.1 or later. - CI providers supported at launch: GitHub Actions (GitHub-hosted runners) and GitLab CI/CD (gitlab.com shared runners). - Provenance attestations are published by default; the --provenance flag is no longer needed. - Available for all npm packages, public or private, scoped or unscoped. - Setup is done on npmjs.com (organization, repository, workflow file name, environment), then in the workflow (permissions and identity token). ### Why it matters The 2025 attacks on package ecosystems rely on stealing long-lived tokens stored in CI systems and on workstations. Trusted publishing removes that static secret from the delivery chain and ties each publication to an identifiable workflow. For teams that publish packages, it is a hardening task to plan before being forced by the next waves of attacks, which GitHub will address from September. Authentication rests on the workflow's identity (organization, repository, workflow file, environment): for packages that no longer accept tokens, a stolen token is no longer enough to publish. ### Takeaway Publishing without a long-lived token is now possible for everyone: the baseline measure against CI secret theft.

Tags : Sécurité, CI/CD, Open Source, DevOps